denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,276 Commits 1 Branch 0 Tags
0edd13b6c85af9baa2d870e82b796f11c5020857
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 0c5dfb741f testing: Fetch the FreeRADIUS tarball from the "old" directory 
Fixes #483.
 2014-01-31 17:51:45 +01:00
Martin Willi 1f4883008e unit-tests: Add some test cases for HTTP GET/POST fetches 2014-01-31 12:18:32 +01:00
Martin Willi 1691b19900 unit-tests: Fix test_runner_run() apidoc 2014-01-29 13:38:10 +01:00
Martin Willi 0cec570a4b NEWS: Add unit testing improvements 2014-01-24 13:19:55 +01:00
Martin Willi d048a319df ike: Restart inactivity counter after doing a CHILD_SA rekey 
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.
 2014-01-23 16:19:22 +01:00
Martin Willi 763e035335 child-sa: Add a getter for CHILD_SA install time 2014-01-23 16:19:22 +01:00
Martin Willi 76d073c5ab Merge branch 'pam-session' 
Add support for PAM session management in xauth-pam.
 2014-01-23 16:14:46 +01:00
Martin Willi 572582f5de NEWS: Introduce PAM session management 2014-01-23 16:11:54 +01:00
Martin Willi c5dc94dc8a man: Document xauth-pam session option 2014-01-23 16:07:04 +01:00
Martin Willi 7dc8bf495b xauth-pam: Sanitize XAuth attributes before passing them to PAM 2014-01-23 16:07:04 +01:00
Martin Willi 5770e28e96 Merge branch 'vendor-ids' 
Refactors IKEv2 vendor ID handling, and introduces some IDs seen when talking
to Cisco devices.
 2014-01-23 16:04:48 +01:00
Martin Willi c7c2e24a56 ikev2: Add Cisco FRAGMENTATION vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:04 +01:00
Martin Willi 2c6d204bec ikev2: Add Cisco Copyright vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:04:01 +01:00
Martin Willi f84d1cb2f9 ikev2: Add Cisco Delete Reason vendor ID 
Courtesy of C.J. Adams-Collier, ZeroLag Communications, Inc.
 2014-01-23 16:03:55 +01:00
Martin Willi a8d8e631f9 ikev2: Use a more dynamic vendor ID database, as we use with IKEv1 2014-01-23 16:02:18 +01:00
Martin Willi 6a620f9936 Merge branch 'chunk-mmap' 
Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.
 2014-01-23 15:57:45 +01:00
Martin Willi 853498155e libpts: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 7ae878c357 tnccs: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi 88fa7f62be pem: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:33 +01:00
Martin Willi ecdef634aa stroke: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b8d0103e31 radattr: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 39badc53cd libfast: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi 69be6a9e05 integrity-checker: Use chunk_map() instead of non-portable mmap() 2014-01-23 15:55:32 +01:00
Martin Willi b9ee059ca9 chunk: Externalize error reporting in chunk_write() 
This avoids passing that arbitrary label just for error messages, and gives
greater flexibility in handling errors.
 2014-01-23 15:55:32 +01:00
Martin Willi 37374a292a chunk: Provide a fallback chunk_map() if mmap is not available 2014-01-23 15:55:32 +01:00
Martin Willi 1c4a3459f7 chunk: Use dynamically allocated buffer in chunk_from_fd() 
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
 2014-01-23 15:55:32 +01:00
Martin Willi 595b6d9a82 chunk: Add functions to map file contents to a chunk 2014-01-23 15:55:32 +01:00
Martin Willi b034131555 unit-tests: Pass a test suite collection name to print during test execution 
As we except to get more and more test runners for the different components,
we add a name to easily identify them on the test output.
 2014-01-22 15:34:53 +01:00
Martin Willi 589fab2260 array: Add an array_get() function 2014-01-22 15:34:53 +01:00
Martin Willi 027cf7ddcf watcher: Don't complain if select() syscall got interrupted 2014-01-22 15:34:53 +01:00
Martin Willi e49b299867 stream: Make sure no watcher callback is active while changing stream callbacks 
When changing async callbacks on streams, we have to make sure the watcher
callback is not currently active and has temporarily disabled callbacks. This
could have been the case, as we didn't explicitly removed any pending
watcher registration if both callbacks are NULL.

By enforcing the watcher unregistration, we are sure the watcher callback is
not active and currently is not mangling the callback hooks. This should make
sure we avoid any races for the callback variables.
 2014-01-22 15:34:53 +01:00
Martin Willi 2e89bc4b66 printf-hook-builtin: Correctly calculate written bytes in print_in_hook() 
The hook data counts remaining buffer bytes, not used ones. Counting them
correctly fixes a crash for long hexdumps.

Further, print_in_hook() must return the number of bytes that would have been
written, not the actually written bytes. This is important, as we allocate a
dynamic buffer in bus that relies on the exact byte count. Fixes long hexdumps
that got truncated.
 2014-01-15 18:28:43 +01:00
Martin Willi 1cbe4e6ce4 tun-device: Include <linux/types.h> before <linux/if_tun.h> 
Fixes a build error on CentOS 6.4.
 2013-11-22 09:09:06 +01:00
Martin Willi 07ca25909b printf-hook-builtin: Don't use %P to print uppercase hex pointers 
We use %P as custom printf specifier for proposals.
 2013-11-20 16:57:28 +01:00
Martin Willi 27467a6881 Merge branch 'unit-tests' 
Replace the "check" based libstrongswan unit test framework with our own,
giving us more flexibility for our specific needs.

The new framework is more portable and uses complete libstrongswan init/deinit
cycles for each test to properly catch leaks. It fully supports multi-threaded
tests, and brings many of them for all threading primitives, watcher and
streams.

The --enable-unit-tests option is not required anymore for libstrongswan tests,
but still is for the still "check" based charon-tkm tests.
 2013-11-06 10:31:07 +01:00
Martin Willi 09d0c9030a unit-tests: Separate test runner to a library, reusable by other tests 
Other users may make use of the noinst libtest.la helper library to implement
unit tests. For libstrongswan, tests.[ch] provide the configuration for test
runner to perform unit tests in a simple manner.
 2013-11-06 10:31:07 +01:00
Martin Willi 5a3230a250 unit-tests: Use some include magic to define test suite constructors 
Avoid editing of several files when creating test suites by using a single
header file to define test suite constructor functions.
 2013-11-06 10:31:07 +01:00
Martin Willi d9d0eef92b unit-tests: Check printing of strings having zero length 2013-11-06 10:31:07 +01:00
Martin Willi 61934203e2 unit-tests: Add some basic tests if PRI* printf specifiers work as expected 2013-11-06 10:31:06 +01:00
Martin Willi a4cbda35ce unit-tests: Add a semaphore wait cancel test 2013-11-06 10:31:06 +01:00
Martin Willi fae1b85223 unit-tests: Add a semaphore absolute timed wait test 2013-11-06 10:31:06 +01:00
Martin Willi a14935ea4b unit-tests: Add a semaphore timed wait test case 2013-11-06 10:31:06 +01:00
Martin Willi ffab2e0c95 unit-tests: Add a simple semaphore test 2013-11-06 10:31:06 +01:00
Martin Willi b1bfe59560 unit-tests: Add a spinlock test case 2013-11-06 10:31:06 +01:00
Martin Willi 478dc0257c unit-tests: Add a rwlock condvar thread cancel test 2013-11-06 10:31:05 +01:00
Martin Willi b92c173b28 unit-tests: Add a rwlock condvar absolute timed wait test 2013-11-06 10:31:05 +01:00
Martin Willi af19213c54 unit-tests: Add a rwlock condvar wait test 2013-11-06 10:31:05 +01:00
Martin Willi 1032f52d68 unit-tests: Add a rwlock condvar broadcast test 2013-11-06 10:31:05 +01:00
Martin Willi f644b9e853 unit-tests: Add a rwlock condvar test 2013-11-06 10:31:05 +01:00
Martin Willi dac31fe1a0 unit-tests: Add a rwlock test case 2013-11-06 10:31:05 +01:00
Martin Willi 8b25b5c36f unit-tests: Add a condvar test where wait gets cancelled 2013-11-06 10:31:04 +01:00
Martin Willi b7db393d01 unit-tests: Add a condvar test working on a recursive mutex 2013-11-06 10:31:04 +01:00
Martin Willi 8699a32b74 unit-tests: Add a condvar absolute timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 31f9f777b3 unit-tests: Add a condvar timed wait test 2013-11-06 10:31:04 +01:00
Martin Willi 9a0a891e6b unit-tests: Add condvar broadcast test 2013-11-06 10:31:04 +01:00
Martin Willi 13183a74d4 unit-tests: Add a simple condvar test 2013-11-06 10:31:04 +01:00
Martin Willi 21df985148 unit-tests: Add a thread local storage cleanup test 2013-11-06 10:31:03 +01:00
Martin Willi 0b00e63e49 unit-tests: Add a thread local storage fuzzer test 2013-11-06 10:31:03 +01:00
Martin Willi fd26b7ff1b unit-tests: Add a thread cleanup pop test 2013-11-06 10:31:03 +01:00
Martin Willi 4aec0c5543 unit-tests: Add cleanup test cases for different thread exit situations 2013-11-06 10:31:03 +01:00
Martin Willi e5b34086f1 unit-tests: Add a test for thread_cancellation_point() 2013-11-06 10:31:03 +01:00
Martin Willi 49e6848bd0 unit-tests: Add thread cancellability testing 2013-11-06 10:31:03 +01:00
Martin Willi 855747eab7 unit-tests: Add a simple thread_cancel() test 2013-11-06 10:31:02 +01:00
Martin Willi c320c61160 unit-tests: Add thread_exit() tests to both join and detach test cases 2013-11-06 10:31:02 +01:00
Martin Willi 274e6beb00 unit-tests: Add a simple thread detach test 2013-11-06 10:31:02 +01:00
Martin Willi 5d4a882f45 unit-tests: Add a simple thread join() test 2013-11-06 10:31:02 +01:00
Martin Willi b942528419 unit-tests: Add test suite for streams and services 2013-11-06 10:31:02 +01:00
Martin Willi 8eda87af86 unit-tests: Add a few test cases for watcher 2013-11-06 10:31:02 +01:00
Martin Willi 23b8f9bf86 unit-tests: Support testing multi-threaded code 2013-11-06 10:31:01 +01:00
Martin Willi f23fd4c59b unit-tests: Use a home-brew thread barrier to remove pthread dependency 2013-11-06 10:31:01 +01:00
Martin Willi b74b8addf8 unit-tests: Show how many test vectors have failed on test failure 2013-11-06 10:31:01 +01:00
Martin Willi b4d43a542f unit-tests: Skip fmemopen() based printf() tests if not available 2013-11-06 10:31:01 +01:00
Martin Willi 45766923b8 unit-tests: Avoid name clash with clone() from <sched.h> 2013-11-06 10:31:01 +01:00
Martin Willi 1254ad01b9 unit-tests: Fix a compiler warning in identification tests 2013-11-06 10:31:01 +01:00
Martin Willi 382fa8b419 unit-tests: Clean up memory in new asn1 unit tests 
Test runner checks for leaks when leak detective is enabled.
 2013-11-06 10:31:00 +01:00
Martin Willi 712940d161 unit-tests: Pass linked_list->invoke* varargs as uintptr_t 
Passing integers of unspecified length may result in passing an integer shorter
than uintptr_t. When reading them back, we might get more data than passed,
resulting in a failure.
 2013-11-06 10:31:00 +01:00
Martin Willi f7b8396af0 unit-tests: Initialize backtracing before printing any backtraces 2013-11-06 10:31:00 +01:00
Martin Willi bbb62267e0 thread: Note that tread_cancellation_point temporarily activates cancelability 2013-11-06 10:31:00 +01:00
Martin Willi 7a13990964 backtrace: Support backtracing even if library is not initialized 
But of course backtracing must be initialized anyway using backtrace_init().
 2013-11-06 10:31:00 +01:00
Martin Willi a5860cddae unit-tests: Enable libstrongswan tests even if --enable-unit-tests not set 
As we don't depend on the check framework anymore, we can enable the unit tests
by default. These are built/executed with "make check" only, so it makes no
sense to disable them.
 2013-11-06 10:31:00 +01:00
Martin Willi 6531afb557 automake: Don't use parallel test harness being the default with automake 1.13 
We have no need for the parallel test harness, and we prefer to have the output
of make check on the console
 2013-11-06 10:30:59 +01:00
Martin Willi 35e8eb93a0 unit-tests: Implement testing framework without "check" 2013-11-06 10:30:59 +01:00
Martin Willi 56866ecf3d leak-detective: Call {gm,local}time_r() to allocate static buffer 
On OS X Mavericks, these functions use a static allocation and are hard
to whitelist using other means.
 2013-11-06 10:30:59 +01:00
Martin Willi ef6d78d6ef leak-detective: Register OS X specific hooks just once 
If we initialize libstrongswan more than once in the same process, we may
not register the hooks twice.
 2013-11-06 10:30:59 +01:00
Martin Willi f192526c3f leak-detective: Reset leak list during cleanup 
This resets leak detective state should it get created/destroyed more than once.
 2013-11-06 10:30:59 +01:00
Martin Willi a426851f63 leak-detective: Use callback functions to report leaks and usage information 
This is more flexible than printing reports to a FILE.
 2013-11-06 10:30:59 +01:00
Martin Willi 9ae1140118 unit-tests: Move test suites to its own subfolder 2013-11-06 10:30:58 +01:00
Martin Willi 10900ed7e7 charon-xpc: Set AUTH_RULE_IDENTITY_LOOSE on responder config 
This allows the server to use a different IKE identity as long as the
configured hostname is contained in the certificate.
 2013-11-01 12:05:48 +01:00
Martin Willi b76e96e2ef ike: Don't immediately DPD after deferred DELETEs following IKE_SA rekeying 
Some peers seem to defer DELETEs a few seconds after rekeying the IKE_SA, which
is perfectly valid. For short(er) DPD delays, this leads to the situation where
we send a DPD request during set_state(), but the IKE_SA has no hosts set yet.
Avoid that DPD by resetting the INBOUND timestamp during set_state().
 2013-11-01 11:33:29 +01:00
Martin Willi 7f4a13fffb identification: Properly check length before comparing for binary DN equality 
Fixes CVE-2013-6075.
 2013-10-31 21:57:07 +01:00
Martin Willi ed3eb62723 unit-tests: Additionally do reverse match checking with empty identities 2013-10-31 21:57:07 +01:00
Martin Willi e02b12e374 unit-tests: Test matching against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi df12b3a61f unit-tests: Test for equality against some empty data identities 2013-10-31 21:57:07 +01:00
Martin Willi c409be2506 unit-tests: Let identity equality test fail if a->equals(b) != b->equals(a) 2013-10-31 21:57:07 +01:00
Martin Willi d402e87d16 whitelist: Read multiple commands until client closes connection 
This restores the same behavior we had before e11c02c8, and fixes the whitelist
add/remove-from command.
 2013-10-29 14:22:52 +01:00
Martin Willi 1ba47fa565 charon-xpc: Load missing eap-md5 plugin after enabling it 2013-10-28 15:18:11 +01:00
Martin Willi 9f2a4d3315 charon-xpc: Disable warnings about deprecated functions 
This avoids all the deprecated warnings when using OpenSSL functins.
 2013-10-28 14:51:59 +01:00
Martin Willi f5ea7d781f charon-xpc: Avoid -all_load linker flag 
This seems to be not required anymore with the LLVM 5 toolchain.
 2013-10-28 14:51:51 +01:00
Martin Willi a1c2ed8820 charon-xpc: Properly xpc_retain() connections we xpc_release() 2013-10-28 14:51:40 +01:00
Martin Willi 888d8d73ab charon-xpc: Properly cast SA identifier to uintptr representation 2013-10-28 14:51:28 +01:00